Microsoft this week pushed safety updates to repair greater than 60 vulnerabilities in its Home windows working techniques and supported software program, together with not less than one zero-day bug that’s already being exploited. Microsoft additionally mounted a glitch that prevented some Home windows 10 customers from making the most of an additional yr of safety updates, which is good as a result of the zero-day flaw and different crucial weaknesses patched as we speak have an effect on all variations of Home windows, together with Home windows 10.
Affected merchandise this month embody the Home windows OS, Workplace, SharePoint, SQL Server, Visible Studio, GitHub Copilot, and Azure Monitor Agent. The zero-day menace issues a reminiscence corruption bug deep within the Home windows innards known as CVE-2025-62215. Regardless of the flaw’s zero-day standing, Microsoft has assigned it an “vital” score slightly than crucial, as a result of exploiting it requires an attacker to have already got entry to the goal’s machine.
“These kinds of vulnerabilities are sometimes exploited as a part of a extra advanced assault chain,” mentioned Johannes Ullrich, dean of analysis for the SANS Expertise Institute. “Nevertheless, exploiting this particular vulnerability is prone to be comparatively simple, given the existence of prior comparable vulnerabilities.”
Ben McCarthy, lead cybersecurity engineer at Immersive, known as consideration to CVE-2025-60274, a crucial weak point in a core Home windows graphic element (GDI+) that’s utilized by a large variety of functions, together with Microsoft Workplace, internet servers processing photographs, and numerous third-party functions.
“The patch for this must be a corporation’s highest precedence,” McCarthy mentioned. “Whereas Microsoft assesses this as ‘Exploitation Much less Doubtless,’ a 9.8-rated flaw in a ubiquitous library like GDI+ is a crucial threat.”
Microsoft patched a crucial bug in Workplace — CVE-2025-62199 — that may result in distant code execution on a Home windows system. Alex Vovk, CEO and co-founder of Action1, mentioned this Workplace flaw is a excessive precedence as a result of it’s low complexity, wants no privileges, and will be exploited simply by viewing a booby-trapped message within the Preview Pane.
Lots of the extra regarding bugs addressed by Microsoft this month have an effect on Home windows 10, an working system that Microsoft formally ceased supporting with patches final month. As that deadline rolled round, nonetheless, Microsoft started providing Home windows 10 customers an additional yr of free updates, as long as they register their PC to an energetic Microsoft account.
Judging from the feedback on final month’s Patch Tuesday publish, that registration labored for lots of Home windows 10 customers, however some readers reported the choice for an additional yr of updates was by no means supplied. Nick Carroll, cyber incident response supervisor at Nightwing, notes that Microsoft has just lately launched an out-of-band replace to handle points when attempting to enroll within the Home windows 10 Client Prolonged Safety Replace program.
“If you happen to plan to take part in this system, ensure you replace and set up KB5071959 to handle the enrollment points,” Carroll mentioned. “After that’s put in, customers ought to have the ability to set up different updates comparable to as we speak’s KB5068781 which is the most recent replace to Home windows 10.”
Chris Goettl at Ivanti notes that along with Microsoft updates as we speak, third-party updates from Adobe and Mozilla have already been launched. Additionally, an replace for Google Chrome is predicted quickly, which implies Edge may also be in want of its personal replace.
The SANS Web Storm Heart has a clickable breakdown of every particular person repair from Microsoft, listed by severity and CVSS rating. Enterprise Home windows admins concerned in testing patches earlier than rolling them out ought to regulate askwoody.com, which frequently has the thin on any updates gone awry.
As at all times, please don’t neglect to again up your information (if not your whole system) at common intervals, and be at liberty to hold forth within the feedback for those who expertise issues putting in any of those fixes.
[Author’s note: This post was intended to appear on the homepage on Tuesday, Nov. 11. I’m still not sure how it happened, but somehow this story failed to publish that day. My apologies for the oversight.]
